What is dark AI? How it works, what it looks like, and how to stay safe

What is dark AI?

Dark AI refers to the use of artificial intelligence systems, models, and automation for harmful goals. Criminals exploit the dark side of AI to write phishing emails and malicious code, clone voices, generate fake videos, scrape personal data, or scale attacks that once required more time and skill.

Dark AI uses the same core technology as legitimate AI tools. The difference is intent:

• Ethical AI helps people work faster, summarize information, spot patterns, and make better decisions. 
• Dark AI helps criminals impersonate real people, automate deception, find vulnerabilities, and avoid detection.

The same technology can serve very different goals. The traits below explain why dark AI can be harder to spot than traditional cyber threats.

Core traits of dark AI

Dark AI is often characterized by four traits:

• Autonomy. Dark AI can run parts of an attack with little human input. It can generate phishing messages, test targets, sort stolen data, or run account takeover attempts across many accounts at once.
• Adaptability. AI can test what works and change the next attempt. For example, a phishing system may adjust wording, timing, or sender details after earlier messages fail. AI-assisted malware can also change parts of its code to make detection harder.
• Concealment. Criminal groups use encrypted channels, hidden forums, and hard-to-trace payment methods to sell tools, share prompts, and trade stolen data. These channels help criminals share malicious AI tools and make it harder for investigators to trace the people behind them.
• Human-like behavior. Dark AI can imitate how people write, speak, and appear on video. Deep learning, a type of AI that learns patterns from large amounts of data, helps generate synthetic voices, faces, and messages that can seem real.

Dark AI scams can arrive typo free, in a natural tone, and from profiles that look real. These traits make scams harder to spot, so strong AI security habits can help people and companies verify requests before they trust a message, call, or video.

Why dark AI is gaining traction

AI tools are now part of work, school, customer support, finance, marketing, software development, and everyday online life. Wider adoption gives criminals more ways to abuse AI tools, target AI systems, and exploit trust in AI-generated content.

The FBI has warned that AI can help criminals run familiar cyber schemes faster, at a larger scale, and with more automation.¹ The FBI’s Internet Crime Complaint Center has also reported that criminals use generative AI to make social engineering, spear phishing, and financial fraud more believable.²

Ready-made criminal AI tools add to the problem. They allow less skilled criminals to run campaigns that once required coding knowledge, strong writing skills, or video-editing experience.

Dark AI vs. adversarial AI vs. rogue AI

People often confuse dark AI, adversarial AI, and rogue AI. The terms overlap, but each one describes a different problem.

Dark AI describes the criminal use of AI against people, businesses, and public systems. Adversarial AI involves attacks against AI systems. Rogue AI covers AI behavior that goes beyond its intended purpose, permissions, or oversight.

How does dark AI work?

Dark AI often follows the same basic workflow as legitimate machine learning systems. The difference is the goal — criminals use artificial intelligence technologies to bypass safety limits, evade security controls, or deceive people.

Core mechanisms of dark AI

Threat actors rely on several components to use AI for attacks:

• Data collection. Criminals may use leaked passwords, stolen customer records, scraped social media posts, old breach dumps, public videos, voice clips, or company details from the web. The more personal data criminals gather, the more convincing the attack looks.
• Model training. Criminals can train or fine-tune models on stolen data, phishing templates, malware samples, or criminal forum posts. A model that learns from these sources can generate phishing copy, scam scripts, or code that become the base of dark AI attacks.
• Automation and scale. Dark AI systems allow one person to run many versions of the same scam. A criminal can generate hundreds of messages, translate them into different languages, and tailor them to different targets.
• Adaptation and evasion. Dark AI can test which content passes spam filters, which malware variants avoid signature-based tools, or which login attempts trigger fewer alerts.
• Feedback loops. Criminals can feed results back into the system. Successful messages, working lures, and bypassed defenses can make the next attack more convincing or harder to detect.

Common tactics and applications

Dark AI shows up in several common threat types. Some target people directly. Others go after software, accounts, or AI systems.

AI-assisted social engineering

AI can make social engineering more convincing because it helps criminals copy tone, match formatting, and tailor messages to the context. A scam email may sound like it was sent by your manager. A text may refer to your role, a recent delivery, or a service you use. A bot may hold a live conversation and change its answers based on your replies.

The classic “spot the typo” advice no longer works by itself. AI scams can be clean, fluent, and designed to create a sense of urgency, fear, or trust in a more believable way.

AI-assisted malware generation

AI can help criminals create or modify malware. Polymorphic malware changes parts of its code, so signature-based detection tools may fail to match it to known threats. AI can also help test which versions of malicious files avoid filters.

Adversarial AI attacks

Adversarial AI attacks target AI systems directly. In data poisoning, an attacker manipulates training data so that a model learns the wrong patterns. In an evasion attack, an attacker changes an input so an AI classifier — a system that sorts data into categories — labels malicious activity as harmless.

The idea is similar to other poisoning attacks. For example, DNS cache poisoning tricks systems into trusting false routing information. AI data poisoning tricks models into trusting bad training signals.

Large-scale attack automation

AI can make botnets more adaptive. A botnet is a network of infected devices that criminals control remotely. Instead of acting like basic automation tools, AI-assisted botnets can test attack timing, rotate tactics, mimic normal user behavior, and spread attempts across many targets.

Large-scale automation gives criminals more chances to succeed. A scammer can target one person manually. An AI-assisted operation can test many messages, regions, platforms, and sender identities at once.

Common dark AI tools

Criminals can abuse existing AI tools or buy ready-made ones from underground forums, dark web marketplaces, and encrypted chat groups.

The most common categories of dark AI tools include:

• Uncensored chatbots. Criminals use chatbots with fewer safety controls to generate phishing copy, scam scripts, or malicious code.
• Jailbroken mainstream models. Criminals try to bypass safety limits in popular AI tools so the model gives harmful instructions or outputs.
• Purpose-built tools from underground forums. Criminals trade tools that claim to support phishing, malware creation, account abuse, or fraud.

Names that come up often in dark AI discussions include FraudGPT, WormGPT, FreedomGPT, PoisonGPT, and DarkBERT. FraudGPT and WormGPT have been described in security reporting as malicious large language model tools linked to phishing, malware, and hacking support. FreedomGPT is different because it’s generally known as an uncensored chatbot, not a tool built only for cybercrime.

PoisonGPT has been discussed as a proof-of-concept showing how poisoned AI models can spread harmful or false outputs. DarkBERT also belongs in a separate category. Researchers introduced DarkBERT as a language model trained on dark web data for threat intelligence tasks, not as a criminal chatbot.

Treat “dark AI tool” lists with caution. Some names refer to criminal tools. Others refer to research projects, uncensored chatbots, or security demonstrations. Some may also be scams targeting curious users. If you research these tools, use trusted sources, avoid downloads from suspicious forums, and never enter personal data into unknown AI chat sites.

Jailbroken and uncensored AI chatbots

A jailbreak prompt is designed to trick a mainstream AI model into ignoring safety rules. Criminals may use jailbreaks to ask for restricted instructions, such as how to build malware, steal login credentials, or bypass security measures.

Uncensored models raise a different risk. Criminals can modify, fine-tune, or run some models without the safety controls found in mainstream services. They may then adapt those models for phishing, fake support chats, malware assistance, or fraud scripts.

Searches for “dark AI chat” and “dark GPT AI” often lead to risky sites. Some may sell access to illegal tools. Others may be fake login pages, malware downloads, or payment traps. If a tool promises “no rules,” “no limits,” or “undetectable malware,” treat that promise as a warning sign.

Examples of dark AI

The examples below show how criminals use AI to impersonate trusted voices, scale scams, and exploit people’s trust in what they see and hear.

Deepfakes and voice cloning

Deepfakes are AI-generated audio, images, or videos that imitate real people. They can make a person appear to say words they never said or do things they never did. Criminals can use deepfakes to imitate executives, public figures, colleagues, or family members.

A fake video call or cloned voice can exploit the usual trust cues people rely on. A voice or video alone is no longer enough to confirm someone’s identity.

In 2024, Arup, a global design and engineering consultancy, confirmed that it suffered a fraud incident in Hong Kong after criminals used fake voices and images. Hong Kong police said an employee transferred HK$200 million (about $25.6 million) after video calls with people posing as senior company officers.³

In 2026, ABC7 reported that a California mother wired $5,400 after scammers used AI to mimic her daughter’s voice in a fake kidnapping call. The report said the scammers used language with an urgent tone, claimed the daughter was in danger, and pressured the mother to send money before she reached her real daughter.⁴

AI-generated phishing and fraud

Criminals use AI to write polished, personal, and well-timed phishing messages. They can match a company’s tone, imitate a vendor, adjust a message for a specific job title, or turn one scam into hundreds of variations.

In April 2026, KnowBe4 reported that 86% of the phishing attacks it analyzed were AI driven.⁵ That figure helps explain why phishing is now harder to spot at a glance. AI-generated messages can look professional, relevant, and typo free.

AI misinformation and disinformation

AI can generate fake images, audio, videos, and statements at high speed. AI-generated media can target elections, public figures, brands, communities, or news events.

The damage comes from volume. When people see enough convincing forgeries, they start doubting real evidence too.

Fraudsters benefit from that confusion. People hesitate before trusting legitimate warnings, security teams waste time checking false claims, and corrections often reach audiences after the damage has started.

AI-assisted hacking and social engineering bots

AI can help criminals search for software weaknesses, suggest ways to exploit them, sort stolen data, or automate fake conversations. Some social engineering bots can pose as recruiters, support agents, matches on dating apps, or coworkers.

These bots can ask follow-up questions and reuse details from earlier replies. During one automated conversation, a bot can push a target toward a malicious link, unsafe file, payment, or request for login details. It can also collect names, addresses, workplace details, security question answers, and password reset requests, which increases the risk of data theft.

Emerging dark AI threats and challenges

Dark AI-driven threats are moving beyond one-off tasks. Criminals can now use AI across more stages of an attack, from planning to execution.

• Agentic AI can make these attacks faster and harder to track. An AI agent is a system that can plan and carry out multi-step tasks with minimal human input. In criminal hands, an agent could identify targets, create outreach, test responses, and adjust the attack when a target engages.

• Real-time polymorphic malware pushes defenders away from static detection. If malware can change during an attack, security tools need to detect suspicious behavior rather than rely only on known file patterns.
• Deepfakes are putting more pressure on identity verification systems. Criminals can use fake faces, synthetic documents, or manipulated video to bypass KYC verification. Banks, crypto platforms, and other financial services use these checks to verify a user’s identity.
• Regulation creates uneven rules for defenders and criminals. Security teams must follow privacy laws, security rules, and internal governance standards. Criminals don’t follow those limits, which gives them more room to test and adapt their methods.

Frameworks such as the NIST AI Risk Management Framework help organizations identify and manage AI risks. OWASP’s LLM guidance covers risks such as prompt injection and data poisoning. These frameworks won’t stop criminals on their own, but they help security teams use a shared language for AI-related threats.

For a broader look at the threats, check NordVPN’s guide to cybersecurity risks in 2026.

How to protect yourself from dark AI

You don’t need to outsmart every AI tool. Simple habits stop most scams before they compromise your accounts or devices.

1. Verify unusual requests through a second channel

If someone asks for money, sensitive data, or login codes, or pressures you to act fast, verify the request through a separate channel. Call a number you already know. Use an internal chat thread. Contact the person through a trusted account or app.

Don’t reply to the same message thread or call back the number that contacted you. Deepfake scams work best when they keep you inside the criminal’s script.

2. Use MFA and a password manager

Multi-factor authentication (MFA) adds a second login step, such as a passkey, an authentication app code, or a device prompt. MFA can block many account takeover attempts, even if a criminal has your password.

Use a strong, unique password for each account. A password manager can create and store those passwords for you. That way, one data breach doesn’t expose your other accounts.

3. Use strong internet security tools

A reputable antivirus or internet security app can help detect and remove malware from suspicious links, malicious downloads, or AI-generated phishing lures. It can also warn you about risky files before you open them.

If you think your device is infected, don’t change passwords on that device. First, follow the steps to remove malware or a virus. Then change your passwords from a clean device.

4. Monitor for leaked credentials

Leaked email addresses and passwords can fuel AI-driven account takeover. Criminals can feed breach data into AI tools and use personal details to make scams look more credible.

Use dark web monitoring to get alerts if your credentials appear in known leaked databases. If you receive an alert, change the exposed password, secure related accounts, and enable MFA.

5. Reduce your personal data footprint

Criminals can use personal data to make AI-powered attacks look and sound more believable. Public profiles, old posts, data broker records, voice clips, and exposed contact details can help criminals personalize scams.

Limit what you share in public posts and profiles. Review your privacy settings. Delete old accounts you no longer use. For more everyday steps, follow cyber hygiene tips to reduce the data that criminals can collect.

Extra protection from dark AI-related threats

Dark AI often reaches people through familiar routes, including phishing links, fake websites, and infected downloads. A next-gen antivirus can block or flag these threats before they do harm.

NordVPN’s next-gen antivirus helps block malicious and phishing sites, scan downloads for malware, and remove infected files. It can reduce the risk from AI-driven phishing links, fake pages, and malware downloads.

Dark AI tactics will keep changing, so build protection that works even when a deepfake or phishing message slips through. Use security tools and simple habits that help you verify suspicious requests, block risky links, and recover faster if a scam reaches you.

Disclaimer: The trademarks referenced are for illustrative purposes only. NordVPN is not affiliated with, sponsored by, or endorsed by the owners of those trademarks.

References

¹ Federal Bureau of Investigation. (2024, May 8). FBI Warns of Increasing Threat of Cyber Criminals Utilizing Artificial Intelligence. https://www.fbi.gov/contact-us/field-offices/sanfrancisco/news/fbi-warns-of-increasing-threat-of-cyber-criminals-utilizing-artificial-intelligence opens in a new tab  opens in a new tab

² Federal Bureau of Investigation. (2024, December 3). Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud. Internet Crime Complaint Center. https://www.ic3.gov/PSA/2024/PSA241203 opens in a new tab 

³ Chen, H., Magramo, K. (2024, February 4). Finance worker pays out $25 million after video call with deepfake ‘chief financial officer’. CNN. https://edition.cnn.com/2024/02/04/asia/deepfake-cfo-scam-hong-kong-intl-hnk/index.html opens in a new tab  opens in a new tab

⁴ Quigley, D. (2026, May 26). Mom out thousands after scammers use AI to mimic daughter’s voice in fake kidnapping. https://abc7.com/post/california-mom-thousands-scammers-use-ai-mimic-daughters-voice-fake-kidnapping-part-growing-trend/19175361/ opens in a new tab 

⁵ KnowBe4. (2025, April). Phishing Threat Trends Report: Vol. 7. https://www.knowbe4.com/hubfs/Phishing_Threat_Trends_Report_Vol7_en-US.pdf opens in a new tab